### Impact IPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. All users running ip-address-manager versions prior to the patched releases are affected. ### Patches Fixed in: - v1.11.7 - v1.12.4 - v1.13.0 Users should upgrade to the patched version for their release branch. ### Workarounds Manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole: ```yaml # Remove this entire block from the ClusterRole - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch ``` ### Resources - https://github.com/metal3-io/ip-address-manager/pull/1355 - https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12) - https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)
### Impact IPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. All users running ip-address-manager versions prior to the patched releases are affected. ### Patches Fixed in: - v1.11.7 - v1.12.4 - v1.13.0 Users should upgrade to the patched version for their release branch. ### Workarounds Manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole: ```yaml # Remove this entire block from the ClusterRole - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch ``` ### Resources - https://github.com/metal3-io/ip-address-manager/pull/1355 - https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12) - https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)
Update github.com/metal3-io/ip-address-manager to 1.11.7; github.com/metal3-io/ip-address-manager to 1.12.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanIPAM controller service account granted unnecessary full access to Secrets affects github.com/metal3-io/ip-address-manager (go), github.com/metal3-io/ip-address-manager (go). Severity is medium. ### Impact IPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. All users running ip-address-manager versions prior to the patched releases are affected. ### Patches Fixed in: - v1.11.7 - v1.12.4 - v1.13.0 Users should upgrade to the patched version for their release branch. ### Workarounds Manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole: ```yaml # Remove this entire block from the ClusterRole - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch ``` ### Resources - https://github.com/metal3-io/ip-address-manager/pull/1355 - https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12) - https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/metal3-io/ip-address-managergo | <=1.11.6 | 1.11.7 |
| github.com/metal3-io/ip-address-managergo | >=1.12.0,<=1.12.3 | 1.12.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/metal3-io/ip-address-manager to 1.11.7; github.com/metal3-io/ip-address-manager to 1.12.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanIPAM controller service account granted unnecessary full access to Secrets affects github.com/metal3-io/ip-address-manager (go), github.com/metal3-io/ip-address-manager (go). Severity is medium. ### Impact IPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. All users running ip-address-manager versions prior to the patched releases are affected. ### Patches Fixed in: - v1.11.7 - v1.12.4 - v1.13.0 Users should upgrade to the patched version for their release branch. ### Workarounds Manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole: ```yaml # Remove this entire block from the ClusterRole - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch ``` ### Resources - https://github.com/metal3-io/ip-address-manager/pull/1355 - https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12) - https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/metal3-io/ip-address-managergo | <=1.11.6 | 1.11.7 |
| github.com/metal3-io/ip-address-managergo | >=1.12.0,<=1.12.3 | 1.12.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard